Skip to main content

Apache CVE-2025-24813

CRITICAL
Path Equivalence: 'file.name' (Internal Dot) (CWE-44)
2025-03-10 security@apache.org GHSA-83qj-6fr2-vhqg
RCE Apache Information Disclosure Red Hat Suse
Critical
Disputed · 9.8 NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-44
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path traversal prevention
Impact

CVSS 9.8 (Critical). EPSS 94.2% — near-certain exploitation. KEV-listed with active exploitation campaigns. Public PoC weaponized. Affects massive install base across three major Tomcat branches. No authentication required.
Exploit ScenarioDerived

An attacker sends a crafted HTTP PUT request to a Tomcat instance with write-enabled Default Servlet, using path equivalence (e.g., 'file.Name' notation) to upload a malicious serialized Java session file. A subsequent GET request triggers deserialization of the uploaded payload, executing arbitrary code as the Tomcat service account. This enables full server compromise including lateral movement, data exfiltration, and persistence.
Act Now Prioritize within 24-48h. Why: In CISA KEV with patch available.
Exploited in the wild (CISA KEV) Patch available 94.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

A critical path equivalence vulnerability in Apache Tomcat's Default Servlet allows unauthenticated remote code execution through specially crafted PUT requests using internal dot notation in filenames. With EPSS of 94% and active exploitation in the wild, this represents one of the most dangerous Tomcat vulnerabilities in recent years, affecting versions 9.0.0-9.0.98, 10.1.0-10.1.34, and 11.0.0-11.0.2.

Earlier versions of this analysis (1)
v1 Mar 12, 2026 - 19:50 CVSS 9.8

Apache Tomcat path equivalence flaw (CWE-44) in the write-enabled Default Servlet allows attackers to bypass file extension restrictions using internal dot notation ('file.Name'), enabling upload of JSP webshells or other malicious content for remote code execution.

RemediationAI

Upgrade immediately: Tomcat 11.0.3+, 10.1.35+, or 9.0.99+. If patching is delayed, disable write access on Default Servlet (set readonly=true in web.xml). Monitor for suspicious PUT requests to application paths. Review server logs for indicators of exploitation.

Affected Packages

maven org.apache.tomcat.embed:tomcat-embed-core fix: 9.0.99, 10.1.35, 11.0.3
maven org.apache.tomcat:tomcat-catalina fix: 9.0.99, 10.1.35, 11.0.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in maven

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability exploits how Tomcat's DefaultServlet handles partial PUT requests combined with path equivalence. When the Default Servlet is configured with write permissions (readonly=false), attackers can craft PUT requests with dot-manipulated filenames that bypass Tomcat's file type restrictions while still being served as executable content. The attack chain: PUT a serialized session file, then trigger deserialization via GET.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
NVD PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SUSE CRITICAL
Red Hat 8.6 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
Added to CISA KEV
Oct 23, 2025 - 14:49 cisa
CISA KEV
PoC Detected
Oct 23, 2025 - 14:49 vuln.today
Public exploit code
CVE Published
Mar 10, 2025 - 17:15 nvd
CRITICAL 9.8

DescriptionCVE.org

Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.

If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files:

  • writes enabled for the default servlet (disabled by default)
  • support for partial PUT (enabled by default)
  • a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads
  • attacker knowledge of the names of security sensitive files being uploaded
  • the security sensitive files also being uploaded via partial PUT

If all of the following were true, a malicious user was able to perform remote code execution:

  • writes enabled for the default servlet (disabled by default)
  • support for partial PUT (enabled by default)
  • application was using Tomcat's file based session persistence with the default storage location
  • application included a library that may be leveraged in a deserialization attack

Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 2 maven packages depend on org.apache.tomcat.embed:tomcat-embed-core (2 direct, 0 indirect)
  • 2 maven packages depend on org.apache.tomcat:tomcat-catalina (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 11.0.0-M1 and other introduced versions.

Executive ViewAI

Why It Matters

CVE-2025-24813 presents critical security risk rated CVSS 9.8. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems. This vulnerability is actively exploited in the wild (KEV-listed) and requires immediate remediation. Immediate patching is required per CISA KEV mandate.

Business Impact: Severe
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.

Threat Intelligence Overview

Threat Score
7.8/10
Composite threat intelligence
EPSS Score
94.2%
Top 0% exploitable
Exploit
POC
Public exploit code exists
Data Quality
8 sources
Confidence: High
NVD CVE.org CISA KEV EPSS CERT-EU POC (2) Vendor Exploit-DB GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV Yes
Public POC Yes
EPSS 94.2%
Patch available Yes
Active threat Yes
Deciding rule
In CISA KEV with patch available
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Immediate
Exploitation· derived
Active
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Very High

Priority Score

228
Low Medium High Critical
KEV: +50
EPSS: +94
CVSS: +49
PoC: +20
Weaponized: +15
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
Container suse/manager/5.0/x86_64/server:5.0.4.7.19.1 Container suse/multi-linux-manager/5.1/x86_64/server:5.1.0.6.40 Image SLES15-SP4-Manager-Server-4-3-BYOS Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE Image server-image Affected
SUSE Enterprise Storage 7.1 Fixed
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2025:3454 ADVISORY https://access.redhat.com/errata/RHSA-2025:3455 ADVISORY https://access.redhat.com/errata/RHSA-2025:3608 ADVISORY https://access.redhat.com/errata/RHSA-2025:3609 ADVISORY https://access.redhat.com/errata/RHSA-2025:3645 ADVISORY https://access.redhat.com/errata/RHSA-2025:3646 ADVISORY https://access.redhat.com/errata/RHSA-2025:3647 ADVISORY https://access.redhat.com/errata/RHSA-2025:3683 ADVISORY https://access.redhat.com/errata/RHSA-2025:3684 ADVISORY https://access.redhat.com/errata/RHSA-2025:7494 ADVISORY https://access.redhat.com/errata/RHSA-2025:7497 ADVISORY https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq ADVISORY https://vuldb.com/vuln/299092 ADVISORY https://www.herodevs.com/vulnerability-directory/cve-2025-24813 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0954/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:1024/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:1126/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:14896/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:14897/ REF http://www.openwall.com/lists/oss-security/2025/03/10/5 REF https://lists.debian.org/debian-lts-announce/2025/04/msg00003.html REF https://security.netapp.com/advisory/ntap-20250321-0001/ REF https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24813 REF https://www.vicarius.io/vsociety/posts/cve-2025-24813-detect-apache-tomcat-rce REF https://www.vicarius.io/vsociety/posts/cve-2025-24813-mitigate-apache-tomcat-rce REF https://www.vicarius.io/vsociety/posts/cve-2025-24813-tomcat-detect-vulnerability REF https://www.vicarius.io/vsociety/posts/cve-2025-24813-tomcat-mitigation-vulnerability

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy